Search/CVE-2026-50656
● CVE — High

CVE-2026-50656

VendormicrosoftProductmalware protection engineDiscoveredJun 16, 2026UpdatedOct 25, 2026

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".

View graph Watch Export
CVSS v3.1
7.8 HIGH
EPSS
11.2%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
35
sources referencing this CVE
Related IOCs
0
seen in the same coverage
Intelligence Reports1
1 intelligence report available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
EPSS Trend
Aug 16, 2026 → Oct 26, 2026
▲ 0.41pp
10.7% → 11.2% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Connections
38 relationships
Timeline
disclosure → media coverage
Jun 9, 2026
bleepingcomputer.com reports: Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges
Jun 10, 2026
thehackernews.com reports: Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows
Jun 10, 2026
thehackernews.com reports: Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs
Jun 10, 2026
bleepingcomputer.com reports: Microsoft patches YellowKey, GreenPlasma, MiniPlasma zero-days
Jun 10, 2026
helpnetsecurity.com reports: Record Microsoft Patch Tuesday, fresh zero-day
Jun 10, 2026
securityweek.com reports: New Windows Zero-Day Exploit ‘RoguePlanet’ Released
Jun 10, 2026
darkreading.com reports: Nightmare-Eclipse Drops Yet Another Microsoft Exploit, RoguePlanet
Jun 11, 2026
securityweek.com reports: Microsoft Patches Exploited Exchange Server Vulnerability
Jun 11, 2026
securityweek.com reports: ‘GreatXML’ Zero-Day Exploit Bypasses BitLocker
Jun 12, 2026
redhotcyber.com reports: RoguePlanet mette in ginocchio Microsoft Defender! Ed è LPE per Windows
Jun 14, 2026
helpnetsecurity.com reports: Week in review: Exploited Check Point VPN zero-day, Oracle PeopleSoft servers under attack
Jun 16, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 25, 2026
Jun 17, 2026
bleepingcomputer.com reports: Microsoft working on Defender patch for RoguePlanet zero-day
Jun 17, 2026
securityweek.com reports: Microsoft Working on Patch for ‘RoguePlanet’ Zero-Day
Jun 17, 2026
helpnetsecurity.com reports: Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656)
Jun 17, 2026
thehackernews.com reports: Microsoft Confirms RoguePlanet Defender Zero-Day, Says Patch is in Development
Jun 18, 2026
securityweek.com reports: F5 Patches Critical, High-Severity NGINX Vulnerabilities
Jun 18, 2026
securityweek.com reports: Atlassian, Splunk Patch Critical Vulnerabilities
Jun 18, 2026
malwarebytes.com reports: Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control
Jun 21, 2026
helpnetsecurity.com reports: Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack
Jun 30, 2026
bleepingcomputer.com reports: CISA: Windows BlueHammer flaw now exploited by ransomware gangs
Jul 9, 2026
bleepingcomputer.com reports: Microsoft patches RoguePlanet Defender zero-day vulnerability
Jul 9, 2026
thehackernews.com reports: Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges
Jul 9, 2026
securityweek.com reports: Microsoft Patches Defender ‘RoguePlanet’ Vulnerability
Jul 9, 2026
malwarebytes.com reports: Microsoft fixes RoguePlanet zero-day in Defender
Jul 9, 2026
helpnetsecurity.com reports: Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656)
Jul 9, 2026
theregister.com reports: Microsoft closes book on Nightmare Eclipse's RoguePlanet zero-day
Jul 9, 2026
darkreading.com reports: Microsoft Reins in RoguePlanet Zero-Day Threat
Jul 10, 2026
acn.gov.it reports: RoguePlanet: risolta la vulnerabilità in Microsoft Defender
Jul 21, 2026
bleepingcomputer.com reports: Windows LegacyHive zero-day flaw gets free, unofficial patches
Aug 12, 2026
thehackernews.com reports: ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
Aug 12, 2026
helpnetsecurity.com reports: Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)
Aug 13, 2026
bleepingcomputer.com reports: Microsoft patches LegacyHive Windows zero-day vulnerability
Aug 17, 2026
bleepingcomputer.com reports: Microsoft working on Defender patch for ShieldBreak zero-day
Aug 17, 2026
malwarebytes.com reports: ShieldBreak bypasses Microsoft’s patch for earlier Defender flaw
Sep 9, 2026
theregister.com reports: Serial Microsoft 0-day hunter drops yet another Defender exploit
Public PoC (4)
github.com/g0thamRabb1t/CVE-2026-50656-rogueplanet-validationgithub.com/0xredash/CVE-2026-50656github.com/HORKimhab/CVE-2026-50656github.com/eh-amish/Windows-Defender-Security-Auditor-CVE-2026-50656-
Unverified third-party code — review before executing.